ice: Protect the PF mailbox from flooding VFs

[kbowling]

Summary

Wire the shared code mailbox-overflow detector into the VF lifecycle and
virtchnl dispatcher.  E830 controllers use their per-VF hardware
in-flight-message watermark.  On older controllers, attribute a
congested mailbox snapshot to its sender and isolate the offending VF so
that it cannot continue to fill the shared queue.  A physical VFLR, PF
reset, or IOV recreation releases it.

Process at most one initially full mailbox immediately.  If producers
keep it nonempty, leave its interrupt masked and let the periodic admin
timer schedule bounded drain work.  This prevents sustained mailbox
traffic from monopolizing the iflib admin task.

Document both protection models and add failure-injection points for the
isolation and scheduling paths.

On an E810-XXV with two host-attached iavf VFs, injected overflow on VF
0 disabled only that VF while VF 1 completed 60 of 60 pings.  A physical
VFLR and a PF reset each released VF 0; IOV recreation also reset its
cumulative count.  Forced persistent mailbox-pending state produced 20
admin and control-queue passes in five seconds, remained timer-paced,
and did not interrupt sibling traffic.

MFC after:      2 weeks
Sponsored by:   BBOX.io

[kbowling]

VF status reporting prereq